Who it’s for
For HR: The first day is sorted. So is the last.
Friday, 4:10 p.m.
A colleague leaves today, a new one starts on Monday. Who locks the accounts, who takes back the laptop, who assigns the training? That sits in three emails.
With Complass every step is on one checklist, with a due date and evidence. You leave on time for the weekend.
What lands on HR’s desk
Depending on size and sector, some of this applies to you:
- Internal reporting office from usually 50 employees, with acknowledgement and feedback within fixed deadlines Section 12 HinSchG§ 12 HinSchG Pflicht zur Einrichtung interner Meldestellen(1) Beschäftigungsgeber haben dafür zu sorgen, dass bei ihnen mindestens eine Stelle für interne Meldungen eingerichtet ist und betrieben wird, an die sich Beschäftigte wenden können (interne Meldestelle). Ist der Bund oder ein Land Beschäftigungsgeber, bestimmen die obersten Bundes- oder Landesbehörden Organisationseinheiten in Form von einzelnen oder mehreren Behörden, Verwaltungsstellen, Betrieben oder Gerichten. …Open original (gesetze-im-internet.de) ↗ Section 17 HinSchG§ 17 HinSchG Verfahren bei internen Meldungen(1) Die interne Meldestelle - 1. bestätigt der hinweisgebenden Person den Eingang einer Meldung spätestens nach sieben Tagen, - 2. prüft, ob der gemeldete Verstoß in den sachlichen Anwendungsbereich nach § 2 fällt, - 3. hält mit der hinweisgebenden Person Kontakt, - 4. prüft die Stichhaltigkeit der eingegangenen Meldung, - 5. ersucht die hinweisgebende Person erforderlichenfalls um weitere Informationen und - 6. …Open original (gesetze-im-internet.de) ↗
- Staff data in the records of processing activities, stored only as long as necessary Art. 30 GDPRArticle 30 GDPR Records of processing activities1. Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities under its responsibility. That record shall contain all of the following information: - (a) the name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer; - (b) the purposes of the processing; - (c) a …Open original (EUR-Lex – consolidated version incl. corrigenda) ↗ Art. 5 GDPRArticle 5 GDPR Principles relating to processing of personal data1. Personal data shall be: - (a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’); - (b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or …Open original (EUR-Lex – consolidated version incl. corrigenda) ↗
- Answer access requests from employees and applicants, as a rule within one month Art. 12 GDPRArticle 12 GDPR Transparent information, communication and modalities for the exercise of the rights of the data subject1. The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in …Open original (EUR-Lex – consolidated version incl. corrigenda) ↗ Art. 15 GDPRArticle 15 GDPR Right of access by the data subject1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: - (a) the purposes of the processing; - (b) the categories of personal data concerned; - (c) the recipients or categories of recipient to whom the personal data have …Open original (EUR-Lex – consolidated version incl. corrigenda) ↗
- In NIS2 entities: training and awareness as well as concepts for personnel security Section 30(2) nos. 7 and 9 BSIG§ 30 BSIG Risikomanagementmaßnahmen besonders wichtiger Einrichtungen und wichtiger Einrichtungen(1) Besonders wichtige Einrichtungen und wichtige Einrichtungen sind verpflichtet, geeignete, verhältnismäßige und wirksame technische und organisatorische Maßnahmen, die in Absatz 2 konkretisiert werden, zu ergreifen, um Störungen der Verfügbarkeit, Integrität und Vertraulichkeit der informationstechnischen Systeme, Komponenten und Prozesse, die sie für die Erbringung ihrer Dienste nutzen, zu vermeiden und …Open original (gesetze-im-internet.de) ↗
General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.
How Complass helps
Joining, moving, leaving
One checklist instead of three emails
One checklist per person with due date, owner and evidence, adapted to your processes. For joiners Complass proposes the access, policies to acknowledge and the awareness course, and you confirm. For leavers Complass locks the employee access after your confirmation; evidence and certificates stay.
Training and instructions
Who did what? One page.
Assign mandatory training to everyone, to departments or to individuals, with a due date and reminders. Add classroom sessions and external courses by hand or as a CSV import. The record goes to the audit as PDF or Excel. You write your own instructions, for example house rules, with an optional quiz.
Whistleblower protection
The reporting channel is already there
Reports can come in anonymously, without an IP address and encrypted per company. Only the reporting office reads the cases, not even the account owners. Complass tracks the deadlines. The reporting page is available in further languages on request, for example Turkish or Ukrainian.
Complass does not replace HR software: payroll, personnel files and applicant management stay where they are.
Frequently asked questions
What is included and what is extra?
Every package includes joiners and leavers, the employee access, the training record page, the reporting channel and the GDPR and HinSchG frameworks. Academy course seats per person and course are extra, including the awareness course. Privacy operations and your own instructions (Academy and awareness) are bookable modules and included in Professional and Premium.
Does Complass lock accounts in other systems?
No. After your confirmation Complass locks its own employee access. Accounts in other systems are steps on the checklist. With asset management or access reviews Complass also shows the person’s remaining active accounts in your recorded systems and adds them to the checklist with one click.
Do all employees need a portal account?
No. For policies and training the employee access is enough, and it does not take up a user seat. You import people as CSV or from Excel, or keep them in step with groups in Microsoft Entra.
Can HR run the reporting office?
Yes, if those people work independently, without conflicts of interest and with the necessary expertise (Section 15 HinSchG). Check this carefully, because HR can itself be the subject of a report. Alternatively an ombudsperson takes over. Both work with the access “reporting office only”, which takes up no user seat.
What does HR see of the training, and what stays private?
You see the status per person: assigned, completed, due. Administrators do not see the test results of individuals, and effectiveness figures appear only from 5 people. Whether and how you involve the works council is for you to settle in your company.
How do we cover staff data in data protection?
In the privacy operations register you record applications, personnel files and payroll as processing activities with purpose, legal basis and retention period. The retention overview shows gaps, and data subject requests run with a calculated one-month deadline.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.